L09: Privacy Policies, Cookie Policy and Data Schedules
L09-A. Privacy Policy for adults and families
1. Who uses your information
Example Co, company number [Company number to be confirmed], of [Registered office to be confirmed], is responsible for the RTL account, programme and app processing described here where it decides the purposes and means. Contact help@rtlclubs.com or write to [Correspondence address to be confirmed]. Data protection officer or representative, where applicable: [CONFIRM WHETHER REQUIRED AND CONTACT DETAILS]. Your independent tuition provider has its own notice for its teaching business. Where RTL processes particular records only on that provider's instructions, the provider is the controller for that activity. The purpose table below identifies the proposed distinction; it must match the service offered to you.
2. What we collect and why
We receive information from you, authorised learners, their authorised adults or teaching provider, devices using the service, and relevant payment services. The categories and purposes below describe the intended service. Optional or unverified processing must be removed or completed before this notice is published.
| Information and purpose | Proposed lawful basis when RTL is controller |
|---|---|
| Adult identity, contact, credentials, account and orders to provide the adult's service | Contract with the adult; legal obligation for required records |
| Learner identity, programme, assigned materials, progress and reports to provide household learning | Legitimate interests in delivering and administering the requested learning service, subject to a recorded children's interests assessment; the adult's contract is not automatically the child's lawful basis |
| Provider and tutor roles and permissions to allocate appropriate access | Contract for the contracting person's activity; legitimate interests for organisation representatives and access security |
| Billing identifiers, purchase and refund status | Contract, legal accounting obligations and legitimate interests in preventing fraud, as applicable to the particular activity |
| Accepted terms, authority declaration and version receipt | Legitimate interests in evidencing agreements and resolving disputes; relevant legal obligations where identified |
| Help requests, complaints and access-restriction records | Legitimate interests in responding and protecting users and services; specific legal duties where applicable |
| Device, diagnostic and security records necessary to protect and operate the service | Legitimate interests following necessity and balancing assessment; device storage separately follows the Cookie Policy |
| Optional adult marketing or publicity material | Specific consent where selected; no blanket learner or advertising consent |
Essential account and entitlement information is needed to provide the requested service; without it we may be unable to create access or identify the right learners. Optional choices are not a condition of learning. Do not send medical or criminal-record documents through ordinary forms. Before collecting necessary health, safeguarding or criminal-offence information, identify the specific purpose, lawful basis and additional statutory condition and provide suitable notice. This notice itself does not authorise that collection.
3. Who can receive information
Access is limited to authorised household adults and assigned provider staff where needed for the service and lawfully permitted, RTL personnel who need it, and contracted hosting, communications, support or payment services for their defined functions. Guardian access is assessed in light of authority, the child's rights and disputed circumstances. Market partners do not receive learner histories by virtue of their partner role. Authorities or advisers may receive necessary information where lawful for protection, legal duties or claims. Programme licensing alone does not entitle the programme owner to learner data.
Actual service providers, purposes and locations: [COMPLETE ACTUAL VENDOR REGISTER]. Payment services may act as independent controllers under their own notices, linked in the purchase information. We do not describe a payment collector as the tuition supplier merely because it collects money.
4. Overseas processing
Processing countries and any transfers outside the UK: [COMPLETE ACTUAL COUNTRY AND SAFEGUARDS REGISTER]. Before a restricted transfer, use a lawful adequacy route or appropriate safeguards with the required assessment and supplementary protection. Ask help@rtlclubs.com for relevant safeguards, with necessary confidential details protected. Do not publish an assertion that all data stays in the UK without verification.
5. How long we keep information
We keep information only while needed for the stated purpose and applicable legal duties. Account and learner records are assessed against ongoing service need, authorised continuity, rights requests and justified disputes; billing records against applicable accounting requirements; agreement evidence against the need to establish obligations and claims; security and complaint records against proportionate risk and legal holds. Our completed category retention schedule is [COMPLETE CATEGORY RETENTION PERIODS OR SPECIFIC CRITERIA]. It must set periods or sufficiently specific criteria, review triggers and responsible owners before publication. We delete or anonymise information when no lawful need remains, subject to established commitments and lawful holds. G08's limited history access is distinct from retention and does not authorise deleting existing permanent records.
6. Your choices and rights
You can ask for access, correction, erasure, restriction and, where applicable, portability. You can object to processing based on legitimate interests and object to direct marketing at any time. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. Rights depend on the relevant legal conditions; we will explain any lawful refusal. A child has their own rights. A parent does not automatically replace a sufficiently capable child's choices or rights.
Contact help@rtlclubs.com or Help. We may ask for proportionate identity or authority evidence. We respond within applicable statutory deadlines and explain any lawful extension. You may complain directly to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or your competent local authority. You do not have to use our complaints process first.
7. Automated processing and changes
Use of profiling, automated learning recommendations or decisions with legal or similarly significant effects: [VERIFY ACTUAL AUTOMATED PROCESSING AND EXPLAIN IT]. Where applicable, describe meaningful information about logic, effects and human review before use; do not infer absence from this draft. Material new uses require a lawful assessment and clear notice, and fresh consent when needed. A new date does not retrospectively change what an earlier notice said.
L09-B. Privacy notice for children
Your learning information
Example Co provides your learning programme and app. We keep information such as your name, the activities assigned to you and how your learning is going. This helps show the right work and keep your learning record.
Your parent or another authorised adult helps manage your account. Teachers assigned to help you may see the learning information they need. People who support and protect the app may also need some information. This does not mean everyone at a club can see your record.
You can tell us if information is wrong, ask what we keep or ask us to stop using something. Sometimes the law means we need to keep information; we will explain. Your information belongs to your private life, and you have your own rights. You can ask a trusted adult to help, or contact us at help@rtlclubs.com. If the adult you usually ask is part of the problem, choose another trusted adult or contact us directly.
Do not put private things such as your home address or medical details into ordinary learning answers. If you feel unsafe, tell a trusted adult or the appropriate emergency service. Help is not an emergency service. A longer explanation is in the Privacy Policy above. [Before publication: add age-specific audio/visual support and test understanding with the intended ages.]